JP5880195B2 - Information processing system, information processing method, information processing apparatus, control method thereof, and control program - Google Patents

Description

  The present invention relates to a technique for preventing attacks and spread of infection in communication processing.

  In the above technical field, Patent Document 1 discloses a technique for reducing a communication time by providing a cloud router in a communication path between a subscriber terminal device and a service providing server to reduce a communication time. The service providing server includes a server that provides a firewall service.

JP 2011-188263 A

  However, the technique described in the above document cannot block the subscriber terminal device from attacks and infections.

  The objective of this invention is providing the technique which solves the above-mentioned subject.

In order to achieve the above object, a system according to the present invention provides:
The first information processing apparatus is connected to the first information processing apparatus via a network and has substantially the same or higher defense capability against an attack than the first information processing apparatus. An information processing system including a second information processing apparatus,
Communication proxy means of the second information processing device acting as a proxy for at least part of the communication connection between the first information processing device and an external network or external device;
Attack blocking means for blocking an attack included in communication connection by the communication proxy means between the first information processing apparatus and the external network or the external apparatus;
Equipped with a,
The communication proxy means is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking unit detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy unit is deleted, a new virtual computer is generated, and the communication is performed. communication substitution control means for substituting the communication connection of the first information processing apparatus by proxy means and includes Rukoto.

In order to achieve the above object, the method according to the present invention comprises:
A first information processing apparatus are communicatively connected via a network with respect to the first information processing apparatus to have a substantially equal or higher protective capacity against challenge compared to the first information processing apparatus an information processing method in an information processing system and a second information processing apparatus,
A communication proxy step of the second information processing device that performs at least a part of communication connection between the first information processing device and an external network or an external device;
An attack blocking step for blocking an attack included in a communication connection in the communication proxy step between the first information processing device and the external network or the external device;
Only including,
The communication agent step is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking step detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy step is deleted, a new virtual computer is generated, and the communication is performed. the communication proxy control step of substituting the communication connection of the first information processing apparatus by proxy step, characterized by containing Mukoto.

In order to achieve the above object, an apparatus according to the present invention provides:
Communicatively coupled via the first information processing device and the network, a second information processing apparatus having a substantially equal or higher protective capacity against challenge compared to the first information processing apparatus,
Communication proxy means for proxying at least a part of communication connection with the external network or the external device by the first information processing device;
Attack blocking means for blocking an attack included in communication connection by the communication proxy means between the first information processing apparatus and the external network or the external apparatus;
Equipped with a,
The communication proxy means is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking unit detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy unit is deleted, a new virtual computer is generated, and the communication is performed. communication substitution control means for substituting the communication connection of the first information processing apparatus by proxy means and includes Rukoto.

In order to achieve the above object, the method according to the present invention comprises:
Communicatively coupled via the first information processing device and the network, a control method of the second information processing apparatus having a substantially equal or higher protective capacity against challenge compared to the first information processing apparatus ,
A communication proxy step of acting as a proxy for at least part of the communication connection with the external network or the external device by the first information processing device;
An attack blocking step for blocking an attack included in a communication connection in the communication proxy step between the first information processing device and the external network or the external device;
Only including,
The communication agent step is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking step detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy step is deleted, a new virtual computer is generated, and the communication is performed. the communication proxy control step of substituting the communication connection of the first information processing apparatus by proxy step, characterized by containing Mukoto.

In order to achieve the above object, a program according to the present invention provides:
A control program for a second information processing apparatus that is communicably connected to the first information processing apparatus via a network and has substantially the same or higher defense capability against attack than the first information processing apparatus,
A communication proxy step of performing at least a part of communication connection with the external network or the external device by the first information processing device;
An attack blocking step for blocking an attack included in a communication connection in the communication proxy step between the first information processing device and the external network or the external device;
To the computer ,
The communication agent step is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking step detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy step is deleted, a new virtual computer is generated, and the communication is performed. A control program for a second information processing apparatus , comprising: a communication proxy control step for proxying communication connection of the first information processing apparatus by a proxy step .

In order to achieve the above object, an apparatus according to the present invention provides:
The communicatively connected via a second information processing device and the network, a first information processing apparatus having a substantially equal or lower protective capacity against challenge compared to the second information processing apparatus,
A communication proxy request means for requesting to intercept at least a portion of the communication connection with the external network or an external device by the communication proxy unit the second information processing apparatus is the first information processing apparatus,
Communication data attacked by the attack blocking means is blocked by the second information processing apparatus, receiving means for receiving,
It is characterized by providing.

In order to achieve the above object, the method according to the present invention comprises:
A control method for a first information processing apparatus that is communicably connected to the second information processing apparatus via a network and has substantially the same or lower defense capability against an attack than the second information processing apparatus. And
A communication proxy request step for requesting to intercept at least a portion of the communication connection with the external network or an external device by the communication proxy unit the second information processing apparatus is the first information processing apparatus,
Communication data attacked by the attack blocking means is blocked with said second information processing apparatus, a receiving step of receiving,
It is characterized by including.

In order to achieve the above object, a program according to the present invention provides:
A control program for a first information processing apparatus that is communicably connected to the second information processing apparatus via a network and has substantially the same or lower defense capability against an attack than the second information processing apparatus. And
A communication proxy request step for requesting to intercept at least a portion of the communication connection with the external network or an external device by the communication proxy unit the second information processing apparatus is the first information processing apparatus,
Communication data attacked by the attack blocking means is blocked with said second information processing apparatus, a receiving step of receiving,
Is executed by a computer.

  ADVANTAGE OF THE INVENTION According to this invention, a 1st information processing apparatus can be interrupted | blocked from an attack by proxying communication by the 2nd information processing apparatus which has a higher defense capability with respect to an attack than a 1st information processing apparatus.

It is a block diagram which shows the structure of the information processing system which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the information processing system which concerns on 2nd Embodiment of this invention. It is a sequence diagram which shows the operation | movement procedure of the communication substitution request in the information processing system which concerns on 2nd Embodiment of this invention. It is a sequence diagram which shows the operation | movement procedure of communication substitution execution in the information processing system which concerns on 2nd Embodiment of this invention. It is a figure which shows the structure of the communication message of the information processing system which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the function structure of the cloud server which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the function structure of the client apparatus which concerns on 2nd Embodiment of this invention. It is a figure which shows the structure of the IP address conversion table which concerns on 2nd Embodiment of this invention. It is a figure which shows the structure of the communication data cache part which concerns on 2nd Embodiment of this invention. It is a figure which shows the structure of attack / infection information DB which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the hardware constitutions of the cloud server which concerns on 2nd Embodiment of this invention. It is a flowchart which shows the process sequence of the cloud server which concerns on 2nd Embodiment of this invention. It is a flowchart which shows the process sequence of the message transmission process to the service provision server which concerns on 2nd Embodiment of this invention. It is a flowchart which shows the process sequence of the message transmission process to the client apparatus which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the hardware constitutions of the client apparatus which concerns on 2nd Embodiment of this invention. It is a figure which shows the structure of the infection alerting | reporting information which concerns on 2nd Embodiment of this invention. It is a flowchart which shows the process sequence of the client apparatus which concerns on 2nd Embodiment of this invention. It is a flowchart which shows the process sequence of the communication proxy application which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the function structure of the cloud server which concerns on 3rd Embodiment of this invention. It is a block diagram which shows the structure of the information processing system which concerns on 4th Embodiment of this invention. It is a sequence diagram which shows the operation | movement procedure of the communication proxy in the information processing system which concerns on 5th Embodiment of this invention. It is a figure which shows the structure of the communication message of the information processing system which concerns on 5th Embodiment of this invention. It is a block diagram which shows the function structure of the cloud server which concerns on 5th Embodiment of this invention. It is a block diagram which shows the function structure of the client apparatus which concerns on 5th Embodiment of this invention. It is a figure which shows the structure of the IP address conversion table which concerns on 5th Embodiment of this invention. It is a figure which shows the structure of the communication data cache part which concerns on 5th Embodiment of this invention. It is a figure which shows the structure of attack / infection information DB which concerns on 5th Embodiment of this invention. It is a flowchart which shows the process sequence of the cloud server which concerns on 5th Embodiment of this invention. It is a flowchart which shows the process sequence of the message transmission process to the service provision server which concerns on 5th Embodiment of this invention. It is a flowchart which shows the process sequence of the message transmission process to the client apparatus which concerns on 5th Embodiment of this invention. It is a flowchart which shows the process sequence of the client apparatus which concerns on 5th Embodiment of this invention. It is a flowchart which shows the process sequence of the communication proxy application which concerns on 5th Embodiment of this invention. It is a sequence diagram which shows the operation | movement procedure of the communication proxy in the information processing system which concerns on 6th Embodiment of this invention. It is a block diagram which shows the function structure of the cloud server which concerns on 6th Embodiment of this invention. It is a figure which shows the structure of the IP address conversion table which concerns on 6th Embodiment of this invention. It is a block diagram which shows the structure of the information processing system which concerns on 7th Embodiment of this invention. It is a sequence diagram which shows the operation | movement procedure of the communication substitution in the information processing system which concerns on 7th Embodiment of this invention. It is a sequence diagram which shows the operation | movement procedure of the communication proxy in the information processing system which concerns on 8th Embodiment of this invention. It is a block diagram which shows the function structure of the cloud server which concerns on 8th Embodiment of this invention. It is a figure which shows the structure of attack target learning DB which concerns on 8th Embodiment of this invention. It is a figure which shows the structure of the attack target analysis table which concerns on 8th Embodiment of this invention. It is a flowchart which shows the process sequence of the attack target learning process by the cloud server which concerns on 8th Embodiment of this invention. It is a sequence diagram which shows the operation | movement procedure of the communication substitution in the information processing system which concerns on 9th Embodiment of this invention. It is a block diagram which shows the function structure of the cloud server which concerns on 9th Embodiment of this invention.

  Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the drawings. However, the constituent elements described in the following embodiments are merely examples, and are not intended to limit the technical scope of the present invention only to them.

  Note that the terms “defense” and “defense” used in this specification refer to the ability to protect a PC from the “latest threats” on the Internet, such as various web sites and emails, in an environment connected to the Internet. try. Various products are commercially available for the defense program. There are various tests for examining whether their defensive ability is high or low. For example, the AV-comparatives test is famous (http://www.av-test.org, http://www.av-comparatives.org). In addition to AV-TEST.org accreditation, CHECKMARK accreditation (West Coast Lab), ICSA labs accreditation (Cybertrust), VIRUS BULLETIN 100% award, etc. show the defense ability of the program. In these tests, a virus detection rate / non-detection rate and a known / unknown malware detection rate representing the defense capability of the scan engine alone are used. There is also a malware block test that examines the defense capabilities of the entire security software. By combining these, it is possible to determine whether “defense ability” and “defense ability” are high or low.

  In the present embodiment, “client device” and “client” are different targets, and the term “client” uses a user who owns “client device” or “client device”. Represents a user.

[First Embodiment]
An information processing system 100 as a first embodiment of the present invention will be described with reference to FIG. The information processing system 100 includes a first information processing apparatus 101 and a second information processing apparatus 102 that are communicatively connected via a network 103. Further, the second information processing apparatus 102 has substantially the same or higher defense capability against the attack than the first information processing apparatus 101.

  As illustrated in FIG. 1, the information processing system 100 includes a communication proxy unit 110, an attack blocking unit, a communication proxy unit 110, and an attack blocking unit 120. The communication proxy unit 110 performs at least a part of communication connection between the first information processing apparatus 101 and the external network 104 or the external apparatus 105. The attack blocking unit 120 blocks attacks included in the communication connection by the communication proxy unit 110 between the first information processing apparatus 101 and the external network 104 or the external apparatus 105.

  According to the present embodiment, the first information processing apparatus can be blocked from the attack by proxying the communication with the second information processing apparatus having a higher defense capability against the attack than the first information processing apparatus.

[Second Embodiment]
Next, an information processing system according to the second embodiment of the present invention will be described. In the information processing system according to the present embodiment, the cloud server that is the second information processing apparatus performs the communication process of the client apparatus that is the first information processing apparatus. The client device includes a mobile terminal such as a mobile phone, a smartphone, and a tablet, a business terminal, a notebook personal computer (hereinafter referred to as a PC), a digital TV, a display terminal, a desktop PC, and the like. The term “terminal” in the specification and drawings is also synonymous with the client device.

  According to this embodiment, the cloud server can eliminate attacks on the client device, and the cloud server can prevent the spread of infection from the client device.

《Information processing system》
FIG. 2 is a block diagram illustrating a configuration of the information processing system 200 according to the present embodiment.

  The information processing system 200 includes client apparatuses 211 to 216, a cloud server 220, a web server 230 that is a service providing server, an SNS (Social Networking Service) server 240, and a content providing server 250 connected via a network. Prepare.

  The client devices 211 to 216 include client devices 211 to 213 that are portable terminals, a client device 214 that is a notebook PC, a client device 215 that is a digital television, and a client device 216 that is a desktop PC. The client devices 211 to 216 request the cloud server 220 having a higher defense capability to perform communication processing of the own device, eliminate attacks included in the communication processing to the own device, and perform communication from the own device. Prevent the spread of infection by treatment.

  The cloud server 220 includes an IP (Internet Protocol) address conversion table 221, a communication data cache unit 222, and an attack / infection information DB 223 that are necessary for proxying communication of the client device. The IP address conversion table 221 is a table for converting the IP address of the client device in order to disconnect communication between the client device and the external network or external device (see FIG. 7). The communication data cache unit 222 is a cache unit that temporarily stores communication data with an external network or an external device (see FIG. 8). The attack / infection information DB 223 is a database that stores information for detecting and eliminating attacks in the cloud server 220 or detecting an infection source and preventing infection (see FIG. 9).

  The Web server 230 is a server that provides Web services to client devices. The SNS server 240 is a server that provides a social service to the client device. The content providing server 250 is a server that provides various contents to the client device. The service providing server is not limited to the example illustrated in FIG.

<< Operation procedure of information processing system >>
Next, an operation procedure of the information processing system 200 according to the present embodiment will be described with reference to FIGS. 3A and 3B.

(Communication agency request)
FIG. 3A is a sequence diagram illustrating an operation procedure of a communication proxy request in the information processing system 200 according to the present embodiment.

  In step S <b> 301, communication between the client apparatuses 211 to 216 and the cloud server 220 is established. In step S303, the cloud server 220 transmits the communication proxy service introduction information to the client devices 211 to 216. In step S305, the client apparatuses 211 to 216 display the received communication proxy service introduction information. When the client inputs a request for the communication proxy service from the client devices 211 to 216, information on the communication proxy request is transmitted from the client device to the cloud server 220 in step S307.

  In step S309, the cloud server 220 acquires the terminal IP address of the client device from the received communication proxy request information. In step S311, a local IP address assigned to the requested client device is set. In step S313, the terminal IP address and the local IP address are associated with each other and registered in the IP address conversion table. In step S315, the local IP address is notified to the client apparatus requested from the cloud server 220, and the communication proxy application program (see FIG. 16) to be added to the client apparatus is downloaded.

  In step S317, the client apparatuses 211 to 216 set the received local IP address as the IP address of the own apparatus used in the subsequent communication. Thereafter, the terminal IP address that the client device initially has is used by the cloud server 220 and is not used by the client device. Therefore, direct communication with the external network or the external device by the client device is avoided. Next, in step S319, the downloaded communication proxy application is activated. In the following, this client apparatus will perform communication processing on behalf of the cloud server 220.

  Since the communication proxy request process is completed, the communication between the client apparatuses 211 to 216 and the cloud server 220 is disconnected in step S321.

(Communication proxy execution)
FIG. 3B is a sequence diagram illustrating an operation procedure of communication proxy execution in the information processing system 200 according to the present embodiment. FIG. 3B shows an example in which a service request is made by a client responding to an introduction from a service providing server.

  In step S331, service introduction information is distributed from the service providing server. Access to the terminal IP address of the client device is received by the cloud server 220 as in step S333. In step S335, an attack included in the received service introduction information message is checked, and if there is an attack, it is eliminated. If the message including the attack is discarded or the attack is eliminated, the message is transmitted to the client device in step S337. In particular, the IP address used is the local IP address assigned to the client device in step S315 of FIG. 3A.

  The service introduction information transmitted from the cloud server 220 with the local IP address as the transmission destination is displayed on the client device in step S339. If the client responds to the service introduction information, a service request is transmitted from the client device to the cloud server 220 in step S341. Of course, the source of the service request is the client device identified by the local IP address.

  In step S343, the cloud server 220 that has received the service request from the client device checks whether or not the message from the client device is infected, and eliminates any infection. Then, in step S345, a service request message without infection is transmitted by the cloud server 220 on behalf of the terminal IP address as the transmission source.

  In step S347, the service providing server receives a service request with the terminal IP address as the transmission source from the cloud server 220, and returns service information with the terminal IP address as the transmission destination to the cloud server 220 in step S349.

  In step S351, the cloud server 220 receives service information from the service providing server on behalf of it. In step S353, the message attack including the service information is checked for an attack, and if there is an attack, it is eliminated. If the service information message including the attack is discarded or the attack is eliminated, in step S355, the message is transmitted to the client apparatus with the transmission destination as the local IP address.

  In step S357, the client apparatus acquires the received service. In step S359, it is determined whether or not the access from the client device to the service providing server is to be terminated. If not completed, the process returns to step S341 to repeat the next service request. If the access to the service providing server is completed, the process proceeds to step S361, and the client device notifies the cloud server 220 of the end. The cloud server 220 receives the end notification and performs end processing in step S363.

  FIG. 3B shows an example in which the client makes a service request by responding to the introduction from the service providing server. However, if the client designates the service providing server without introduction, the process can be entered from step S341. Good.

<Example of communication message>
FIG. 4 is a diagram illustrating a configuration of a communication message of the information processing system 200 according to the present embodiment. In addition, the structure of the communication message of FIG. 4 is an example, and is not limited to this.

  The upper part of FIG. 4 is a diagram illustrating conversion of the configuration of the communication message from the client apparatuses 211 to 216 to the service providing server via the cloud server 220. In the transmission message 410 from the client device 211 to 216 to the cloud server 220, the cloud IP address is set as the transmission destination, the local IP address assigned to the client device as the transmission source, and the server IP address as the transfer destination. In the transmission message 420 from the cloud server 220 to the service providing server, the server IP address is arranged as the transmission destination, and the terminal IP address of the client apparatus with which the cloud server 220 performs communication substitution is arranged as the transmission source. This conversion is executed with reference to the IP address conversion table 221.

  The lower part of FIG. 4 is a diagram illustrating conversion of the communication message configuration from the service providing server to the client apparatuses 211 to 216 via the cloud server 220. In the transmission message 430 from the service providing server to the cloud server 220, the terminal IP address of the client device with which the cloud server 220 performs communication proxy is arranged at the transmission destination, and the server IP address is arranged at the transmission source. In the transmission message 440 from the cloud server 220 to the client apparatuses 211 to 216, the local IP address assigned to the client apparatus as the transmission destination, the cloud IP address as the transmission source, and the server IP address as the transfer source are arranged. This conversion is executed with reference to the IP address conversion table 221.

  In FIG. 4, the transfer destination and the transfer source are service providing servers. However, this is the same even if this is another client device and the communication is mail communication. As described above, the service providing server and the other client devices communicate with each other as a desired client device, but the communication is performed by the cloud server 220.

<Functional configuration of cloud server>
FIG. 5 is a block diagram showing a functional configuration of the cloud server 220 according to the present embodiment.

  The cloud server 220 includes a communication control unit 501 that communicates with the service providing server and the client device via the network 260. The message transmitted / received in the communication control unit 501 is checked by the attack blocking unit 500 with reference to the attack / infection information DB 223 to determine whether the message contains an attack or whether the message is infected. And if an attack or infection is found, message passing is blocked. The attack blocking unit 500 includes an attack / infection information DB 223, an infection prevention unit 502, and an attack exclusion unit 509. Note that the infection prevention unit 502 and the attack exclusion unit 509 are functionally separated, but may be integrated.

  The message received from the client device by the communication control unit 501 is checked by the infection prevention unit 502 with reference to the attack / infection information DB 223, although the message is not infected, and if infected, it is blocked or eliminated. A transmission message from the client device that has passed through the infection prevention unit 502 is received by the terminal transmission data reception unit 503. The message received by the terminal transmission data receiving unit 503 includes a message requesting the cloud server 220 to perform communication substitution and a normal transmission message.

  A message requesting communication proxy is registered by the proxy communication registration unit 504 in the IP address conversion table 221 as the client device that has requested proxy communication. The client device registered in the IP address conversion table 221 by the proxy communication registration unit 504 includes a local IP used for communication between the registered client device and the cloud server 220 by the local IP address transmission unit 505. An address is assigned.

  On the other hand, the normal transmission message is stored in the communication data cache unit 222 by the terminal transmission data storage unit 506 in the order of reception time and in association with the client device. Then, the normal transmission message is read from the communication data cache unit 222 by the terminal transmission data reading unit 507 according to the urgency or first-in / first-out rule, and the terminal transmission data transmission unit 508 transmits the terminal IP address. It is sent to the service providing server as a source

  The message received from the service providing server in the communication control unit 501 is checked by the attack elimination unit 509 with reference to the attack / infection information DB 223, but the message does not contain an attack. If it contains an attack, it is blocked or eliminated. The The transmission message from the service providing server that has passed through the attack exclusion unit 509 is received by the terminal reception data reception unit 510. The message received by the terminal reception data reception unit 510 is stored in the communication data cache unit 222 by the terminal reception data storage unit 511 in association with the service providing server / client device in the order of reception time. Then, the transmission message from the service providing server is read from the communication data cache unit 222 by the terminal reception data reading unit 512 according to the urgency or first-in / first-out rule, and is transmitted by the terminal reception data transmission unit 513 to the local IP. The address is transmitted to the client device as a transmission destination.

<< Functional configuration of client device >>
FIG. 6 is a block diagram illustrating a functional configuration of the client apparatuses 211 to 216 according to the present embodiment.

  The client devices 211 to 216 include an operation unit 601 including a touch panel and a keyboard, and an input / output unit 608. The input / output unit 608 includes a display unit 609 that displays received data, and an audio input / output unit 610 that inputs and outputs audio.

  In the case of an instruction for requesting the communication proxy to the cloud server 220 among the instructions of the client input from the operation unit 601, the communication proxy request unit 602 generates a communication proxy request message, and the cloud server via the communication control unit 603 220. At this time, as the transmission source, the client apparatus uses the initially assigned terminal IP address. When the communication proxy request message is received by the cloud server 220, a local IP address is assigned from the cloud server 220 via the communication control unit 603. The local IP address acquisition unit 604 acquires this local IP address and stores it in the local IP address storage unit 605. Subsequent communication of the client device is performed only with the cloud server 220 using this local IP address for both transmission and reception.

Message transmission from the client device to the cloud server 220 is performed by the terminal transmission data transmission unit 606 via the communication control unit 603 with the local IP address as the transmission source. On the other hand, the message reception from the cloud server 220 is performed by the terminal reception data reception unit 607 via the communication control unit 603 with the local IP address as the transmission destination, and is output to the input / output unit 608.
(IP address conversion table)
FIG. 7 is a diagram showing a configuration of the IP address conversion table 221 according to the present embodiment.

  The IP address conversion table 221 is a local IP address 702 newly assigned to the client device in association with the initial terminal IP address 701 of the requested client device when the cloud server 220 requests and accepts the communication proxy. Remember. The IP address conversion table 221 realizes registration of a client device that performs communication proxy and IP address conversion that prevents the client device from being directly attacked.

  Note that the same processing is possible when the client device determines the transmission source of the received message and does not receive anything other than from the cloud server 220. However, since an attack may already be received at the time of determining the transmission source, it is desirable to change the IP address as in this embodiment. The method for changing the IP address is not limited to this example.

(Communication data cache)
FIG. 8 is a diagram showing a configuration of the communication data cache unit 222 according to the present embodiment.

The communication data cache unit 222 includes a server message cache unit 810 that temporarily stores a received message from the service providing server, and a client device message cache unit 820 that temporarily stores a received message from the client device. The cache unit 810 correlates with the reception time 811 of the message from the service providing server in association with the terminal IP address 812 of the transmission destination, the server IP address 813 of the transmission source, the received message (transmission message to the client device) 814, the attack and A communication enable / disable flag 815 based on the presence or absence of infection is stored.

  The client device message cache unit 820 associates with the reception time 821 of the message from the client device, the local IP address 822 of the transmission source, the server IP address 823 of the transfer destination, the received message (transmission message to the service providing server). 824, a communication permission / inhibition flag 825 depending on whether there is an attack or infection is stored.

(Attack / Infection Information DB)
FIG. 9 is a diagram showing a configuration of the attack / infection information DB 223 according to the present embodiment.

  The attack / infection information DB 223 includes address determination information 910, protocol determination information 920, and data / program determination information 930. The configuration of the attack / infection information DB 223 is not limited to this example.

  The address determination information 910 stores a reason 912 for blocking and handling information 913 in association with a communication blocking address 911 for blocking communication. Based on the address determination information 910, the passage / blocking of communication data is determined based on the IP address and port number of the transmission source and transmission destination. A so-called "packet filtering type" firewall is realized.

  The protocol determination information 920 stores a determination condition 922 and handling information 923 in association with the determination target 921 in the communication protocol. Based on the contents of the communication, the passage / blocking of the communication data is determined by the protocol determination information 920. A so-called "application gateway type" firewall is realized. For example, the target and conditions include data in an unused area, an unnecessary flag in the IP header is set, the value is not normal, or the packet length is too long. In the present embodiment, attack / infection detection is not a main feature, and thus detailed description thereof is omitted.

  The data / program determination information 930 stores a determination condition 932 and countermeasure information 933 in association with message data and a determination target 931 in the program. As with the protocol determination information 920, the data / program determination information 930 implements a firewall called “application gateway type”. For example, data patterns, abnormal numerical values, program code arrangement patterns, and the like are included as targets and conditions. In the present embodiment, attack / infection detection is not a main feature, and thus detailed description thereof is omitted.

<< Hardware configuration of cloud server >>
FIG. 10 is a block diagram illustrating a hardware configuration of the cloud server 220 according to the present embodiment.

  In FIG. 10, a CPU 1010 is a processor for arithmetic control, and implements each functional component of the cloud server 220 of FIG. 5 by executing a program. The ROM 1020 stores fixed data and programs such as initial data and programs. Further, the communication control unit 501 is a communication control unit, and in this embodiment, communicates with the client devices 211 to 216 and the service providing server via the network 260. Note that the number of CPUs 1010 is not limited to one, and may be a plurality of CPUs or may include a graphics processing unit (GPU) for image processing.

  The RAM 1040 is a random access memory that the CPU 1010 uses as a work area for temporary storage. The RAM 1040 has an area for storing data necessary for realizing the present embodiment. The client device ID / authentication information 1041 is an identifier of the client device in communication and its authentication information. The local IP address 1042 is an IP address that is assigned to a client device acting for communication and used for communication with the cloud server 220. The terminal IP address 1143 is an initial IP address of a client device that performs communication proxy, and is an IP address that the cloud server 220 that performs communication proxy uses for communication with the outside. The server IP address 1044 is an IP address of a service providing server that the cloud server 220 accesses on behalf of communication. The cloud IP address 1045 is the IP address of this cloud server. The message 1046 before the attack elimination / infection prevention process is an unprocessed message received from the client device or the service providing server. The message 1047 after the attack elimination / infection prevention process is a processed message obtained by performing the attack elimination / infection prevention process on the message 1046. The message communication enable / disable flag 1048 is a flag indicating whether or not the processed message 1047 can be communicated. The transmission / reception message 1049 is a message transmitted / received to / from the client device or the service providing server via the communication control unit 501.

  The storage 1050 stores a database, various parameters, or the following data or programs necessary for realizing the present embodiment. The IP address conversion table 221 is the table shown in FIG. The communication data cache unit 222 is the cache unit illustrated in FIG. The attack / infection information DB 223 is the database shown in FIG.

The storage 1050 stores the following programs. The cloud server control program 1051 is a program that controls the entire cloud server 220. The communication proxy registration module 1052 is a module for registering the communication proxy of the client device requested by the client in the cloud server control program 1051. The terminal-server transfer module 1053 is a module in which the cloud server 220 substitutes message transmission from the client device in the cloud server control program 1051 (see FIG. 12A). The server-terminal transfer module 1054 is a module in which the cloud server 220 acts as a proxy for receiving messages to the client device in the cloud server control program 1051 (see FIG. 12B). The attack elimination / infection prevention module 1055 is a module that, in the cloud server control program 1051, eliminates an attack from message reception to the client device and prevents infection based on message transmission from the client device.
FIG. 10 shows only data and programs essential to the present embodiment, and does not illustrate data and programs not related to the present embodiment.

《Cloud server processing procedure》
FIG. 11 is a flowchart illustrating a processing procedure of the cloud server 220 according to the present embodiment. This flowchart is executed by the CPU 1010 of FIG. 10 using the RAM 1040, and implements the functional configuration unit of FIG.

  First, in step S <b> 1111, it is determined whether or not communication proxy registration is performed by a communication proxy request from a client device. In step S1121, it is determined whether a message from the client device has been received. In step S1131, it is determined whether a message from the service providing server has been received.

  If it is communication proxy registration, the process advances to step S1113 to acquire a local IP address to be assigned to the client device that has requested communication proxy. The cloud server 220 prepares the local IP address in advance. Next, in step S1115, the terminal IP address of the client apparatus that has requested communication substitution in the IP address conversion table 221 is registered in association with the local IP address acquired in step S1113. In step S1117, the local IP address is transmitted to the client device. Thereafter, communication between the cloud server 220 and the client device is executed using the local IP address, and communication with the outside of the client device is performed by communication of the cloud server 220 using the terminal IP address as a transmission source.

  If the message is received from the client device, the process proceeds to step S1123, and processing for preventing the spread of infection by the received message from the client device is executed. If an infection is detected, the client device is notified of this, and if the infection cannot be eliminated, the received message is discarded. In step S1125, the message on which the infection prevention process has been performed is stored in the communication data cache unit 222 in association with the transmission source client device or the transfer destination service providing server. Thereafter, in step S1127, transmission of the message to the service providing server is executed by message transmission processing to the server (see FIG. 12A).

  If the message is received from the service providing server, the process proceeds to step S1133, and processing for eliminating an attack by the received message from the service providing server is executed. If an attack is detected, this is notified to the service providing server, and if the attack cannot be eliminated, the received message is discarded. In step S1135, the message subjected to the attack elimination process is stored in the communication data cache unit 222 in association with the transmission source service providing server or the transmission destination client device. Thereafter, in step S1137, transmission of the message to the client device is executed by message transmission processing to the client device (see FIG. 12B).

(Message transmission processing to the service provider server)
FIG. 12A is a flowchart illustrating a processing procedure of message transmission processing S1127 to the service providing server according to the present embodiment.

  First, in step S1211, it is determined whether the total number of messages from the client device to the service providing server temporarily held in the communication data cache unit 222 is greater than a threshold value m. If not, the process proceeds to step S1221, and it is determined whether or not the total number of messages from the service providing server to the client device temporarily held in the communication data cache unit 222 is greater than a threshold value n. If it is not greater than the threshold value n, the process returns. On the other hand, if it is larger than the threshold value n, the process of step S1137 in FIG. 12B is called and executed.

  If it is determined in step S1211 that the total number of messages from the client device to the service providing server is greater than the threshold value m, the process advances to step S1213. In step S1213, a message having a high priority is selected and acquired from the messages from the client device to the service providing server temporarily held in the communication data cache unit 222. The priority order includes setting of the client device such as urgency and determination by the cloud server, but will not be described in detail here. If there is no priority setting, the selection is made based on the first-in first-out rule.

  In step S1215, the local IP address that is the source of the message from the client device is converted to the original terminal IP address of the client device with reference to the IP address conversion table 221. In step S1217, the message destination is set to the server IP address of the service providing server that is the transfer destination. In step S1219, the message from the client device is subjected to infection prevention processing and transmitted from the cloud server 220 to the service providing server.

(Message transmission processing to the client device)
FIG. 12B is a flowchart illustrating the processing procedure of the message transmission processing S1137 to the client devices 211 to 216 according to the present embodiment.

  First, in step S1231, it is determined whether the total number of messages from the service providing server to the client device temporarily held in the communication data cache unit 222 is greater than a threshold value n. If not, the process proceeds to step S1243, and it is determined whether or not the total number of messages from the client device to the service providing server temporarily held in the communication data cache unit 222 is greater than the threshold value m. If it is not greater than the threshold value m, the process returns. On the other hand, if it is larger than the threshold value m, the process of step S1127 of FIG. 12A is called and executed.

  If it is determined in step S1231 that the total number of messages from the service providing server to the client device is greater than the threshold value n, the process advances to step S1233. In step S1233, a message having a high priority is selected and acquired from the messages from the service providing server to the client device temporarily held in the communication data cache unit 222. The priority order includes setting of a service providing server such as urgency and determination by a cloud server, but will not be described in detail here. If there is no priority setting, the selection is made based on the first-in first-out rule.

  In step S1235, the cloud server 220 converts the terminal IP address, which is the transmission destination of the message from the service providing server, to the local IP address assigned to the client device with reference to the IP address conversion table 221. Next, in step S 1237, the message transmission source is set to the cloud IP address of the cloud server 220. In step S1239, the server IP address of the service providing server that is the message transmission source is changed to the transfer source. Then, the message from the service providing server is attack-deleted and transmitted from the cloud server 220 to the client device.

<< Hardware configuration of client device >>
FIG. 13 is a block diagram illustrating a hardware configuration of the client apparatuses 211 to 216 according to the present embodiment.

  In FIG. 13, a CPU 1310 is a processor for arithmetic control, and implements each functional component of the client devices 211 to 216 in FIG. 6 by executing a program. The ROM 1320 stores fixed data and programs such as initial data and programs. The communication control unit 603 is a communication control unit, and in this embodiment, communicates with the cloud server 220 via a network. Note that the number of CPUs 1310 is not limited to one, and may be a plurality of CPUs or may include a GPU for image processing.

  The RAM 1340 is a random access memory that the CPU 1310 uses as a work area for temporary storage. The RAM 1340 has an area for storing data necessary for realizing the present embodiment. The client ID / authentication information 1341 is a client identifier and its authentication information. The local IP address 1342 is an IP address that is assigned from the cloud server 220 acting as a communication agent and used for communication with the cloud server 220. The cloud IP address 1343 is an IP address of the cloud server 220 acting as a communication agent. The server IP address 1344 is an IP address of a service providing server that the cloud server 220 accesses on behalf of communication. The infection notification information 1345 is notification information received when an infection is detected from a transmission message from the client device (see FIG. 14). Input / output data 1346 indicates input / output data input / output via the input / output interface 1360. Transmission / reception data 1347 indicates transmission / reception data transmitted / received via the communication control unit 603.

  The storage 1350 stores a database, various parameters, or the following data or programs necessary for realizing the present embodiment. The IP address holding unit 1351 holds an IP address used by the client device. The storage 1350 stores the following programs. The client device control program 1352 is a control program that controls the entire client devices 211 to 216. The communication proxy request module 1353 is a module that requests the cloud server 220 for communication proxy in the client device control program 1352. The communication proxy processing module 1354 is a module that processes communication proxy together with the cloud server 220 in the client device control program 1352. The communication agent application program 1355 is a program for executing the communication agent application downloaded from the cloud server 220 at the time of communication agent registration.

  The input / output interface 1360 interfaces input / output data with input / output devices. The input / output interface 1360 is connected to an operation unit 601 such as a display unit 609, a keyboard, a touch panel, and a pointing device. Also, an audio input / output unit 610 such as a speaker or a microphone is connected. Furthermore, a GPS (Global Positioning System) position generation unit 1361, a camera 1362, and the like are connected.

  Note that FIG. 13 shows only data and programs essential to the present embodiment, and data and programs not related to the present embodiment are not shown.

(Infection information)
FIG. 14 is a diagram showing a configuration of infection notification information 1345 according to the present embodiment. The infection notification information 1345 is information notified to the client device when the cloud server 220 detects an infection from a message from the client device.

  In the case of a virus, for example, the infection notification information 1345 stores an infection detection date and time 1402, a message 1403 in which an infection is detected, and a transfer destination 1404 indicating a service providing server that sends the message, in association with the infected virus name 1401. Further, an application program 1405 included in the client device, data 1406 in the message, and handling information 1407 including a treatment method are stored.

  Although not shown, the attack notification information for the attack service providing server detected by the cloud server 220 also has a format similar to that in FIG. Further, the infection notification information 1345 may be notified to the service providing server for reference, or the attack notification information may be notified to the client device. Furthermore, as will be described in detail in the eighth embodiment, it is desirable that the cloud server accumulates infection notification information and attack notification information to notify learning information.

<< Processing procedure of client device >>
FIG. 15 is a flowchart illustrating a processing procedure of the client apparatuses 211 to 216 according to the present embodiment. This flowchart is executed by the CPU 1310 in FIG. 13 while using the RAM 1340, and implements the functional configuration unit in FIG.

  First, in step S <b> 1511, it is determined whether the request is a communication proxy request from the client device to the cloud server 220. In step S1521, it is determined whether a message is transmitted / received by the client device.

  If it is communication proxy registration, the process proceeds to step S1513, and a message requesting communication proxy is transmitted to the cloud server 220. In step S1515, the local IP address assigned from the cloud server 220 and used thereafter is received and stored. In step S1517, the application program downloaded from the cloud server 220 and performing the processing of this embodiment is received and activated. Thereafter, communication between the cloud server 220 and the client device is executed using the local IP address, and communication with the outside of the client device is performed by the cloud server 220 by setting a service providing server as a transfer destination.

  If the message is transmitted / received by the client device, in step S1523, the communication proxy application process (see FIG. 16) received and activated in step S1517 is executed.

(Communication agency application)
FIG. 16 is a flowchart showing a processing procedure of the communication proxy application S1523 according to this embodiment.

  First, in step S1601, it is determined whether the message is transmitted from the client device. If it is message transmission, the process proceeds to step S1603.

  In step S1603, the transmission destination is set to the cloud IP address of the cloud server 220. In step S1605, the transmission source is set to the local IP address. In step S1607, the server IP address of the service providing server to which the message is to be transmitted is set as the transfer destination. In step S1609, the message is transmitted to the destination cloud server. Subsequently, in step S <b> 1611, it is determined whether or not infection notification information is received from the cloud server 220. If infection notification information is not received, the process returns. If infection notification information is received, an infection warning is output based on the received infection notification information in step S1613.

  On the other hand, if the message is not transmitted, that is, if the message is received, it is determined in step S1621 whether the message destination is a local IP address. If the destination is not a local IP address, the process is terminated without doing anything.

  If the destination is a local IP address, the source cloud IP address is acquired in step S1623. Next, the server IP address of the service providing server is acquired from the transfer destination. In step S1627, communication data is acquired from the received message. In step S1629, the acquired communication data is processed.

[Third Embodiment]
Next, an information processing system according to the third embodiment of the present invention will be described. The information processing system according to the present embodiment is different from the second embodiment in that the common part and the specific part for attack elimination and infection prevention in the cloud server are separated. Since other configurations and operations are the same as those of the second embodiment, the same configurations and operations are denoted by the same reference numerals, and detailed description thereof is omitted.

  According to the present embodiment, duplicate processing for eliminating attacks and preventing infection in the cloud server is eliminated, and rapid processing can be performed.

<Functional configuration of cloud server>
FIG. 17 is a block diagram showing a functional configuration of the cloud server 1720 according to the present embodiment. In FIG. 17, the same functional components as those in FIG. 5 of the second embodiment are denoted by the same reference numerals, and description thereof is omitted.

  In FIG. 17, the communication control unit 1701 has a common attack / infection detection unit 1701a that executes a part that can be detected in common in detection of infection and attack between a message from the client device and a message from the service providing server. . The specific infection prevention unit 1702 detects and prevents infection specific to the message from the client device. Further, the attack specific to the message from the service providing server is detected and prevented by the specific attack exclusion unit 1709. The attack blocking unit 1700 of FIG. 17 includes an attack / infection information DB 223, a specific infection prevention unit 1702, and a specific attack exclusion unit 1709. Note that the specific infection prevention unit 1702 and the specific attack exclusion unit 1709 are functionally separated, but may be integrated.

  The processes of the common attack / infection detection unit 1701a, the specific infection prevention unit 1702, and the specific attack exclusion unit 1709 may be performed based on the same attack / infection information DB 223 as in the second embodiment. Alternatively, a separate database may be provided. For example, exclusion based on the transmission source, transmission destination, and IP address by the address determination information 910 in FIG. 9 is performed by the common attack / infection detection unit 1701a. Alternatively, it may be processed as a specific attack / infection at an early stage of infection or attack occurrence, and may be changed to a common attack / infection process if it occurs constantly.

[Fourth Embodiment]
Next, an information processing system according to the fourth embodiment of the present invention will be described. The information processing system according to the present embodiment differs from the third embodiment in that a common part of attack elimination and infection prevention in the cloud server is separated by a router. Since other configurations and operations are the same as those of the third embodiment, the same configurations and operations are denoted by the same reference numerals, and detailed description thereof is omitted.

  According to the present embodiment, it is possible to reduce the load in the attack elimination and infection prevention in the cloud server.

《Information processing system》
FIG. 18 is a block diagram showing a configuration of an information processing system 1800 according to this embodiment. In FIG. 18, the same functional components as those in FIG. 5 of the second embodiment or FIG. 17 of the third embodiment are denoted by the same reference numerals, and description thereof is omitted.

  In FIG. 18, a router 1810 having a common attack / infection detection unit 1811 is connected between the cloud server 1820 and the network 260. The common attack / infection detection unit 1811 refers to the common attack / infection information DB 1812 and executes a portion that can be detected in common in detection of infection or attack between a message from the client device and a message from the service providing server. . The common attack / infection detection unit 1811 may be the same as the common attack / infection detection unit 1701a in FIG. In FIG. 18, a specific infection prevention unit 1702 that prevents infection specific to a message from a client device and a specific attack elimination unit 1709 that excludes an attack specific to a message from a service providing server are the third embodiment. This is the same as FIG. The attack blocking unit 1800 of FIG. 18 includes a specific attack / infection information DB 1823, a specific infection prevention unit 1702, and a specific attack exclusion unit 1709. Note that the specific infection prevention unit 1702 and the specific attack exclusion unit 1709 are functionally separated, but may be integrated.

It is also possible to transfer all infection prevention and attack elimination processes from the cloud server to the router. Also, the common part and the specific part can be processed separately in the router, or the message from the client device and the message from the service providing server can be processed separately as shown in FIG.
[Fifth Embodiment]
Next, an information processing system according to the fifth embodiment of the present invention will be described. The information processing system according to the present embodiment is different from the second to fourth embodiments in that the target for performing proxy substitution by the cloud server and performing attack elimination and infection prevention is limited to the Web service. Since other configurations and operations are the same as those of the second to fourth embodiments, the same configurations and operations are denoted by the same reference numerals, and detailed description thereof is omitted. Note that the limitation to the Web service in the present embodiment is shown as an example of many attacks and infections in the communication processing, and the limitation to other attacks and services with many infections may be performed in the same manner. Note that the term “development data” means data obtained by developing a display screen into dot data in units of pixels. “Web data” is object-based data, and is data that has not been developed into dot data.

  According to the present embodiment, it is possible to eliminate attacks on client devices and prevent infection while restricting the load on the cloud server by substituting the cloud server for Web services that are particularly vulnerable to attacks and infections.

<< Operation procedure of information processing system >>
FIG. 19 is a sequence diagram showing an operation procedure of communication substitution in the information processing system 1900 according to the present embodiment. In FIG. 19, the same steps as those in FIG. 3 of the second embodiment are denoted by the same step numbers, and the description thereof is omitted.

  When the client selects an attack defense related to the web service from the attack defense services displayed in step S305, the cloud server 1920 is notified of an attack defense request related to the web service in step S1907.

  In step S1909, the cloud server 1920 registers the terminal IP address of the client device in association with the virtual terminal IP address used when the cloud server 1920 accesses the service providing server. Thereafter, access to the Web service from the client device is performed by the cloud server 1920 using the possible terminal IP address as a transmission source. Ordinary mail other than the Web service in the client device is directly executed by the terminal IP address in the client device. Next, in step S1911, the cloud server 1920 downloads the application program according to the present embodiment to the client device. The client device receives the application program transmitted in step S1913 and starts in step S2915.

  In the subsequent processing of the client terminal, the Web service is selected in step S1921. Processing other than the Web service is directly transmitted / received from the client device without being performed by the cloud server 1920 as in the present embodiment. In step S1923, a Web service request is transmitted from the client device to the cloud server 1920.

  In step S 1925, the cloud server 1920 that has received the Web service request from the client device checks whether or not the message from the client device is infected, and eliminates any infection. In step S1927, the cloud server 1920 transmits a message of an uninfected Web service request using the virtual terminal IP address as a transmission source, and a session between the cloud server 1920 and the service providing server starts.

  Thereafter, the communication data between the cloud server 1920 and the client device is exchanged not with the received message of the virtual web browser of the cloud server 1920 but with dot data obtained by expanding the received data on the screen. The expanded dot data may be compressed. That is, in step S1929, a display frame in which the client device arranges the expanded data received from the cloud server 1920 is generated. In step S1931, the Web service session start screen is displayed by fitting the received data into the display frame. Therefore, the client can operate the client device as if the client device is executing a Web browser.

  When an information request by the client is input to the client device, transmission data of the information request is transmitted to the cloud server 1920 in step S1933. The cloud server 1920 generates a Web browser transmission message based on the transmission data received from the client device, and transmits the Web message to the service providing server in step S1937. The service providing server receives the information requesting Web message to acquire information, and returns a Web message including information to be provided to the cloud server 1920 in step S1399.

  In step S1941, the cloud server 1920 performs an attack check on the received Web message, and discards the message if there is an attack and cannot be eliminated. The attack checked message is expanded into output information in step S1943. In step S1945, the output information is compressed, and in step S1947, the screen development data is transmitted to the client device.

  In step S1949, the client device arranges and displays the received screen development data in the display frame set in step S1929. Since the communication between the client device and the cloud server 1920 is expanded data as in the present embodiment, it is data communication in which infection and attack are eliminated. In addition, since the data length and the data amount of the expanded data can be predicted, it is possible to easily detect infection and attack by comparing with the threshold value.

  In step S1951, it is determined whether or not the access from the client device to the service providing server is to be terminated. If not completed, the process returns to step S1933 to repeat the next service request. If the access to the service providing server is completed, the process advances to step S1953, and the client device notifies the cloud server 1920 of the end. The cloud server 1920 receives the end notification, and performs a session end process with the service providing server by the virtual Web browser in step S1955.

《Communication message》
FIG. 20 is a diagram showing a configuration of a communication message of the information processing system 1900 according to the present embodiment. In addition, the structure of the communication message of FIG. 20 is an example, and is not limited to this.

  The upper part of FIG. 20 is a diagram illustrating conversion of the configuration of the communication message from the client devices 1911 to 1916 to the service providing server via the cloud server 1920. In the transmission message 2010 from the client device 1911 to 1916 to the cloud server 1920, the cloud IP address is arranged at the transmission destination, the terminal IP address of the client device is arranged at the transmission source, and the server IP address is arranged at the transfer destination. Here, the data is expanded data. Then, in the transmission message 2020 from the cloud server 1920 to the service providing server, a server IP address is assigned to the transmission destination, and a virtual terminal IP address assigned corresponding to the client device that has requested the transmission agency for the transmission is arranged. This conversion is executed with reference to the IP address conversion table 2121. Here, the data is Web data.

  The lower part of FIG. 20 is a diagram illustrating the conversion of the communication message configuration from the service providing server to the client devices 1911 to 1916 via the cloud server 1920. In the transmission message 1030 from the service providing server to the cloud server 1920, the virtual terminal IP address assigned corresponding to the client device with which the cloud server 1920 is acting as the communication destination is arranged in the transmission destination, and the server IP address is arranged in the transmission source. The Here, the data is Web data. In the transmission message 1940 from the cloud server 1920 to the client devices 1911 to 1916, the terminal IP address of the client device is set as the transmission destination, the cloud IP address as the transmission source, and the server IP address as the transfer source. This conversion is executed with reference to the IP address conversion table 2121. Here, the data is expanded data.

  In FIG. 20, the transfer destination and transfer source are Web services of the service providing server. In the present embodiment, in the case of mail communication with a service providing server or another client device, communication is performed directly from the client device without being substituted by the cloud server 1920.

<Functional configuration of cloud server>
FIG. 21 is a block diagram showing a functional configuration of the cloud server 1920 according to the present embodiment. In FIG. 21, the same functional components as those in FIG. 5 of the second embodiment are denoted by the same reference numerals, and description thereof is omitted.

  First, unlike FIG. 5, in the IP address conversion table 2121, the terminal IP address of the client device and the virtual terminal IP address that the cloud server 1920 uses for accessing the service providing server are registered in association with each other ( (See FIG. 23A). Further, the communication data cache unit 2122 temporarily holds communication data in association with an IP address different from that in FIG. 5 (see FIG. 23B). In addition to the attack / infection information DB 223 in FIG. 5, the attack / infection information DB 2123 stores a threshold value for determining an attack or infection from the amount of communication data between the client device and the cloud server 1920 (see FIG. 24). .

  The attack blocking unit 2100 of FIG. 21 includes an attack / infection information DB 2123, an infection prevention unit 2102, an attack exclusion unit 509, and a second attack exclusion unit 2114. Note that the infection prevention unit 2102, the attack exclusion unit 509, and the second attack exclusion unit 2114 are functionally separated, but may be integrated. The infection prevention unit 2102 performs infection detection based on the length of received data and the amount of received data from the client device in addition to the infection prevention of the infection prevention unit 502 in FIG. The proxy communication registration unit 2104 registers the IP address used in this embodiment in the IP address conversion table 2121. The terminal transmission data generation / transmission unit 2108 generates Web terminal transmission data from the expanded data received from the client device read from the communication data cache unit 2122, and transmits the generated data to the service providing server. The terminal reception data expansion / transmission unit 2113 expands the Web data received from the service providing server read from the communication data cache unit 2122, generates terminal reception data, and transmits it to the client device. The second attack exclusion unit 2114 detects and eliminates the expanded data transmitted from the terminal reception data expansion / transmission unit 2113 to the client device based on the data length and the data amount.

<< Functional configuration of client device >>
FIG. 22 is a block diagram illustrating a functional configuration of the client apparatuses 1911 to 1916 according to the present embodiment. In FIG. 22, the same functional components as those in FIG. 6 of the second embodiment are denoted by the same reference numerals, and description thereof is omitted.

  The Web service selection unit 2205 determines that a communication connection to the Web service is about to be made based on a client operation on the operation unit 601. If it is a communication connection to the Web service, the terminal transmission data is transmitted to the cloud server 1920 that has requested the terminal transmission data transmission unit 606 to perform the communication proxy.

(IP address conversion table)
FIG. 23A is a diagram showing a configuration of the IP address conversion table 2121 according to the present embodiment.

  When the IP address conversion table 2121 requests communication agency and is accepted by the cloud server 1920, the IP address conversion table 2121 is associated with the initial terminal IP address 2311 of the requested client device, and newly corresponds to the client device. Stores the virtual terminal IP address 2312 used by. Such an IP address conversion table 2121 realizes registration of a client device that performs communication proxy and IP address conversion that prevents the client device from being directly attacked during Web service.

(Communication data cache)
FIG. 23B is a diagram showing a configuration of the communication data cache unit 2122 according to the present embodiment.

The communication data cache unit 2122 includes a server message cache unit 2320 that temporarily stores a received message from the service providing server, and a client device message cache unit 2330 that temporarily stores a received message from the client device. The cache unit 2320 associates the reception time 2321 of the message from the service providing server with the destination virtual terminal IP address 2322, the source server IP address 2323, and the received message (Web message before transmission to the client device). 2324, a communication permission flag 2325 depending on whether there is an attack or infection is stored.

  The client device message cache unit 2330 correlates with the reception time 2331 of the message from the client device, the terminal IP address 2332 of the transmission source client device, the server IP address 2333 of the transfer destination, the received message (transmitted to the service providing server) (Development data message before execution) 2334 and a communication enable / disable flag 2335 depending on the presence or absence of an attack or infection is stored.

(Attack / Infection Information DB)
FIG. 24 is a diagram showing a configuration of the attack / infection information DB 2123 according to the present embodiment.

  The attack / infection information DB 2123 includes address determination information 910, protocol determination information 920, and data / program determination information 930, similar to the attack / infection information DB 223 of FIG. Further, the attack / infection information DB 2123 has a data amount threshold 2410 for easily detecting an attack or infection based on the development data communicated between the client device and the cloud server 1920. The data amount threshold value 2410 includes a terminal transmission data amount threshold value 2411 that the client device transmits to the cloud server 1920 and a terminal reception data amount threshold value 2412 that the client device receives from the cloud server 1920. The configuration of the attack / infection information DB 2123 is not limited to this example.

《Cloud server processing procedure》
FIG. 25 is a flowchart showing a processing procedure of the cloud server 1920 according to the present embodiment. This flowchart is executed by the CPU 1010 of FIG. 10 using the RAM 1040, and implements the functional configuration unit of FIG. In FIG. 25, steps similar to those in FIG. 11 of the second embodiment are denoted by the same step numbers, and description thereof is omitted.

  First, in step S2511, it is determined whether or not communication proxy registration is performed by a Web service communication proxy request from a client device. In step S2521, it is determined whether a message including expanded data from the client device has been received. In step S2531, it is determined whether a Web message has been received from the service providing server.

  If it is Web service communication proxy registration, the process advances to step S2513 to acquire a virtual terminal IP address to be assigned to the client device that has requested communication proxy. The cloud server 1920 prepares the virtual terminal IP address in advance. Next, in step S2515, the terminal IP address of the client device that has requested communication proxy in the IP address conversion table 2121 and the virtual communication IP address acquired in step S2513 are registered in association with each other. Thereafter, in the case of a Web service, communication between the cloud server 1920 and the service providing server is executed using the virtual terminal IP address, and communication with the outside of the client device in the Web service is transmitted from the virtual terminal IP address. It is substituted by communication of the cloud server 1920.

  If a message including expanded data from the client device is received, the process advances to step S2523 to execute a process for preventing the spread of infection by the received message from the client device. In this infection spread prevention process, simple detection based on the communication data length and the communication data amount is performed in addition to the process of the second embodiment. If an infection is detected, the client device is notified of this, and if the infection cannot be eliminated, the received message is discarded. In step S2525, the message including the decompressed data received from the client device is temporarily stored in the communication data cache unit 2122 in association with the transmission source client device or the transfer destination service providing server. Thereafter, transmission of the Web message to the service providing server is executed by message transmission processing to the server (see FIG. 26A).

  If a Web message is received from the service providing server, the process advances to step S1133 to execute processing for eliminating an attack caused by the received message from the service providing server. If an attack is detected, this is notified to the service providing server, and if the attack cannot be eliminated, the received message is discarded. In step S2535, the Web message subjected to the attack elimination process is stored in the communication data cache unit 2122 in association with the transmission source service providing server or the transmission destination client device. Thereafter, transmission of the expanded message to the client device is executed by message transmission processing to the client device (see FIG. 26B).

(Message transmission processing to the service provider server)
FIG. 26A is a flowchart showing a processing procedure of message transmission processing S2527 to the service providing servers 230 to 250 according to the present embodiment. In FIG. 26A, steps similar to those in FIG. 11A of the second embodiment are denoted by the same step numbers, and description thereof is omitted.

  First, in step S1211, it is determined whether the total number of messages from the client device to the service providing server temporarily held in the communication data cache unit 2122 is greater than a threshold value m. If not, the process proceeds to step S1221, and it is determined whether the total number of messages from the service providing server to the client device temporarily held in the communication data cache unit 2122 is greater than a threshold value n. If it is not greater than the threshold value n, the process returns. On the other hand, if it is larger than the threshold value n, the process of step S2537 of FIG. 26B is called and executed.

  If it is determined in step S1211 that the total number of messages from the client device to the service providing server is greater than the threshold value m, the process advances to step S2613. In step S2613, a message with a high priority is selected and acquired from the messages from the client device to the service providing server temporarily held in the communication data cache unit 2122. In step S 2615, a Web message is generated based on the expanded data read from the communication data cache unit 2122.

  In step S2617, the terminal IP address that is the source of the message from the client device is converted into a virtual terminal IP address assigned to the client device with reference to the IP address conversion table 2121. In step S2619, the message transmission destination is set to the server IP address of the service providing server that is the transfer destination. In step S2621, the web message from the client device is subjected to infection prevention processing, and is transmitted from the cloud server 1920 to the service providing server.

(Message transmission processing to the client device)
FIG. 26B is a flowchart illustrating a processing procedure of message transmission processing S2537 to the client devices 1911 to 1916 according to the present embodiment. In FIG. 26B, the same step numbers are assigned to the same steps as in FIG. 11B of the second embodiment.

  First, in step S1231, it is determined whether or not the total number of web messages from the service providing server to the client device temporarily held in the communication data cache unit 2122 is greater than a threshold value n. If not, the process proceeds to step S1243, and it is determined whether the total number of messages from the client device to the service providing server temporarily held in the communication data cache unit 2122 is greater than the threshold value m. If it is not greater than the threshold value m, the process returns. On the other hand, if it is larger than the threshold value m, the process of step S2527 in FIG. 26A is called and executed.

  If it is determined in step S1231 that the total number of messages from the service providing server to the client device is greater than the threshold value n, the process advances to step S1233. In step S1233, a high priority message is selected and acquired from the Web messages from the service providing server to the client device temporarily held in the communication data cache unit 2122.

  Next, in step S2635, the Web message read from the communication data cache unit 2122 is expanded to generate expanded data. Then, based on the data length and data amount of the expanded data, a simple determination of the presence or absence of an attack is performed.

  In step S 1237, the message transmission source is set to the cloud IP address of the cloud server 1920. In step S1239, the server IP address of the service providing server that is the message transmission source is changed to the transfer source. Then, the deployment data from the service providing server is subjected to attack deletion processing and transmitted from the cloud server 1920 to the client device.

<< Processing procedure of client device >>
FIG. 27 is a flowchart illustrating a processing procedure of the client apparatuses 1911 to 1916 according to the present embodiment. This flowchart is executed by the CPU 1310 in FIG. 13 while using the RAM 1340, and implements the functional configuration unit in FIG. In FIG. 27, the same steps as those in FIG. 15 of the second embodiment are denoted by the same step numbers.

  First, in step S2711, it is determined whether the request is a Web service communication proxy request from the client device to the cloud server 1920. In step S1521, it is determined whether a message is transmitted / received by the client device.

  If it is Web service communication proxy registration, the process proceeds to step S2713, and a message requesting Web service communication proxy is transmitted to the cloud server 1920. In step S1517, the application program downloaded from the cloud server 1920 and performing the processing of this embodiment is received and activated. Thereafter, Web communication with the outside of the client device is performed by the cloud server 1920 by setting a service providing server as a transfer destination.

  If the message is transmitted and received by the client device, the process advances to step S2721, and it is determined whether the message is a Web service. In the case of normal mail communication that is not a Web service, the process advances to step S2725 to perform normal communication processing directly from the client device. On the other hand, in the case of a Web service, the process proceeds to step S2723, and a Web service communication proxy application process (see FIG. 28) is executed.

(Communication agency application)
FIG. 28 is a flowchart showing a processing procedure of the communication proxy application S2723 according to the present embodiment. In FIG. 27, steps similar to those in FIG. 15 of the second embodiment are denoted by the same step numbers, and description thereof is omitted.

  First, in step S1601, it is determined whether the message is transmitted from the client device. If it is message transmission, the process proceeds to step S1603. In step S2805, the transmission source is set to the terminal IP address of the client device. In step S2809, the expansion data that is the basis of the Web message generated by the cloud server 1920 is transmitted.

If the message is not transmitted from the client device, that is, if the message is received, it is determined in step S2821 whether the source of the received message is a cloud IP address. If it is not a cloud IP address, the process ends without doing anything. That is, for the Web service, communication that the cloud server 1920 does not act on is blocked. Thereafter, in step S2827, expanded data expanded from the Web message is acquired. In step S2829, the expanded data is processed. For example, the expanded data is arranged in the display frame, and processing is performed as if the client received a Web service directly.
[Sixth Embodiment]
Next, an information processing system according to the sixth embodiment of the present invention will be described. The information processing system according to the present embodiment is different from the fifth embodiment in that a Web service that performs communication proxy by a cloud server is shared by a plurality of client devices. Since other configurations and operations are the same as those of the fifth embodiment, the same configurations and operations are denoted by the same reference numerals, and detailed description thereof is omitted. Note that the sharing of a service in the present embodiment by a plurality of client devices is not limited to the Web service, and can be similarly realized in the virtual PC described in the seventh embodiment.

  According to the present embodiment, in a Web service with many attacks and infections, information that has been eliminated and prevented from infection by the cloud server can be shared by a plurality of client devices.

<< Processing procedure of information processing system >>
FIG. 29 is a sequence diagram showing an operation procedure of communication proxy in the information processing system 2900 according to the present embodiment. In FIG. 29, the operation of requesting and registering the communication proxy to the cloud server 2920 is the same as in the above embodiment, and is omitted, and the Web service providing portion is shown. In FIG. 29, steps similar to those in FIG. 19 of the fifth embodiment are denoted by the same step numbers, and description thereof is omitted. FIG. 29 illustrates an example in which the client device 2911 serves as a master device and shares a screen with the client device 2916, but is not limited thereto.

  In step S1915, the client apparatus 2911 and 2916 launches the common application of this embodiment.

  In step S 2923, the client apparatus 2916 sharing the screen is notified of the Web service request from the client apparatus 2911. The notification of screen sharing is not the designation of the device that shares the screen, but the designation of the device that permits screen sharing, and may be configured to share the screen upon request of each device. In step S2925, the cloud server 2920 stores screen sharing and the target device. If the screen is to be shared from the beginning, in step S2931, the expanded data for starting the Web service is transmitted to both the client devices 2911 and 2916. Thereafter, also in step S2945, the expanded data of the Web browser result is transmitted to both the client devices 2911 and 2916.

<Functional configuration of cloud server>
FIG. 30 is a block diagram showing a functional configuration of the cloud server 2920 according to the present embodiment. In FIG. 30, the same functional components as those in FIG. 2 of the second embodiment or FIG. 21 of the fifth embodiment are denoted by the same reference numerals, and description thereof is omitted.

  The screen sharing setting unit 3005 receives a screen sharing setting message from the client device, and registers the terminal IP addresses of a plurality of client devices that share the screen in the IP address conversion table 3021. The terminal transmission data transmission unit 3008 transmits screen data to a plurality of client devices based on the screen sharing setting information registered in the IP address conversion table 3021.

(IP address conversion table)
FIG. 31 is a diagram showing the configuration of the IP address conversion table 2921 according to this embodiment. In FIG. 31, the same reference numerals are given to portions common to FIG. 23A of the fifth embodiment, and description thereof is omitted.

  The IP address conversion table 2921 includes IP conversion information 3110 and screen sharing information 3120 that stores a set of client devices that share a screen, as in FIG. 23A. The screen sharing information 3120 stores a set of screen sharing client devices, a screen sharing first terminal IP address 3121, a screen sharing second terminal IP address 3122,.

[Seventh Embodiment]
Next, an information processing system according to a seventh embodiment of the present invention will be described. The information processing system according to the present embodiment is different from the fifth and sixth embodiments in that communication proxy is performed by a virtual PC that is a virtual computer generated in the cloud server. That is, the information processing system of this embodiment is a thin client server system. Therefore, the communication proxy of this embodiment is not limited to the web service. Since other configurations and operations are the same as those in the fifth and sixth embodiments, the same configurations and operations are denoted by the same reference numerals, and detailed description thereof is omitted.

  According to the present embodiment, when an attack or infection is detected, the effect of the attack or infection can be minimized by deleting the existing virtual PC and performing the process on a new virtual PC.

《Information processing system》
FIG. 32 is a block diagram showing the configuration of the information processing system 3200 according to this embodiment. In FIG. 32, the same reference numerals are given to the same components as those in FIG. 2 of the second embodiment, and description thereof will be omitted.

  The cloud server 3220 of this embodiment has a virtual PC associated with each client device as a configuration that performs communication of the client device. According to the third embodiment, the cloud server 3220 is provided with a common attack / infection detection / exclusion unit and a specific attack / infection exclusion unit included in each virtual PC.

  For example, communication with the SNS server 240 of the client device 211 that is a mobile phone is performed by the first virtual PC. Communication with the Web server 230 of the client device 213 that is a smartphone is performed by the second virtual PC. Further, communication with the content providing server 250 of the client device 216 that is a desktop PC is performed by the third virtual PC. Note that according to the second embodiment, the communication mail between the client apparatuses 211 to 216 may also be substituted by the cloud server 3220.

<< Operation procedure of information processing system >>
FIG. 33 is a sequence diagram showing an operation procedure of communication proxy in the information processing system 3200 according to the present embodiment. In FIG. 33, when the client device 213, which is a smartphone, is performing communication substitution by the second virtual PC of the cloud server 3220, an attack is detected and the substitution is transferred from the second virtual PC to the nth virtual PC. An example of communication proxy control will be described. However, the change of the virtual PC only shows an example of an effective defense against the attack of the client device, and the proxy of the cloud server 3220 by the virtual PC itself can sufficiently cope with the elimination of the attack or the prevention of the spread of infection. is there. Also, in FIG. 33, the operation of requesting and registering the communication proxy to the cloud server 3220 is the same as that in the above embodiment, so it is omitted and the Web service providing portion is shown. In FIG. 33, steps similar to those in FIG. 19 of the fifth embodiment are denoted by the same step numbers, and description thereof is omitted.

  There is a Web service request from the client device 213, and in step S3327, a session between the second virtual PC corresponding to the client device 213 and the service providing server is started. In step S3331, a session start screen is transmitted to the client device 213 and displayed.

  In step S3333, when the first information request instruction from the client is made on the session start screen, the information request is transmitted to the service providing server on behalf of the second virtual PC in step S3335. Upon receiving the information request, the service providing server acquires the requested information and returns it to the second virtual PC of the cloud server 3220 in step S3337.

  In the cloud server 3220 or the second virtual PC, an attack is checked in step S3339. In the following, with reference to FIG. 33, processing when an attack is detected will be described. If no attack is detected, the communication proxy of the client device 213 by the second virtual PC is continued.

  Upon receiving the attack detection, the cloud server 3220 terminates the second virtual PC in step S3341. That is, the operation of the second virtual PC is stopped. In step S3351, a new nth virtual PC is generated and activated. At that time, basic data and applications before the attack detection of the second virtual PC are transferred to the newly generated nth virtual PC. It is also possible to detect attacks or infections when migrating data and applications. Then, all the configuration and information of the second virtual PC are cleared from the cloud server 3220. This clearing is not a superficial address change or file deletion, but erases the trace of the second virtual PC so that, for example, a zero is written in all the storage units.

  If the Web service request from the client device 213 is held in the nth virtual PC, an information request is made to the service providing server in step S3353. If the Web service request from the client device 213 is not held, a session start screen is sent to the client device 213 and an instruction from the beginning of the client is waited for.

  In response to the provision of information from the service providing server in step S3355, the cloud server 3220 and the nth virtual PC check or eliminate the attack in step S3359. If there is an attack, the information provided will be discarded. If there is no attack, in step S3359, the information provided from the service providing server is transmitted from the nth virtual PC to the client device.

  In step S3361, the client device 213 outputs the received information. In step S3363, the end of access to the service providing server is determined. If the access is not completed, the information request instruction process for the nth virtual PC is repeated in step S336. If the access is terminated, an end notification is transmitted to the nth virtual PC in step S3367, and the nth virtual PC ends the session with the service providing server by the web browser in step S3369.

[Eighth Embodiment]
Next, an information processing system according to an eighth embodiment of the present invention will be described. Compared with the second to seventh embodiments, the information processing system according to the present embodiment accumulates the detection of attacks and infections and learns the tendency thereof, and widely disseminates client devices, service providing servers, and the like. Different. Since other configurations and operations are the same as those of the second to seventh embodiments, the same configurations and operations are denoted by the same reference numerals, and detailed description thereof is omitted.

  According to the present embodiment, it is possible to suppress the occurrence of attacks and infections in the information processing system.

<< Operation procedure of information processing system >>
FIG. 34 is a sequence diagram showing an operation procedure of communication proxy in the information processing system 3400 according to this embodiment. In FIG. 34, the operation of requesting and registering the communication proxy to the cloud server 3420 is the same as in the above embodiment, and is omitted, and the service providing portion is illustrated. In FIG. 34, each of three examples of notifying the client device of access warning information is collectively shown. However, it is not limited to these three examples.

(First access warning example)
If there is an access request to the service providing server in step S3401, the service request is transmitted from the client device to the cloud server 3420 in step S3403.

  In the cloud server 3420, in step S3405, infection check and elimination are performed with reference to the attack / infection information DB 223. Next, when an infection is detected in step S3407, the access destination and access target of the infected message are accumulated in the attack target learning DB 3424. At the same time, with reference to the attack target learning DB 3424, information on access destinations and access targets that tend to be targets of attacks and infections is read out. In step S3409, when an infection is detected, an access warning and access target information that tends to be an attack or infection target are transmitted to the client device as access warning information together with an infection warning. The client device outputs the received access warning information.

(Second access warning example)
Information provision from the service providing server to the cloud server 3420 in step S3421 is checked and eliminated in step S3423. Next, when an attack is detected in step S3425, the access source and access target of the attack message are stored in the attack target learning DB 3424. At the same time, with reference to the attack target learning DB 3424, information on access destinations and access targets that tend to be targets of attacks and infections is read. In step S3427, when an attack is detected, an access warning and information on an access target that tends to be an attack or infection target are transmitted as access warning information to the service providing server and the client device together with the attack warning.

(Example of third access warning)
In step S3431, the cloud server 3420 reads and analyzes the attack and infection information stored in the attack target learning DB 3424, and determines an access destination and an access target that tend to be targets of the attack and infection. In step S3433, access destination information and access target information that tends to be targets of attacks and infections are transmitted as access warning information to the service providing server and the client device.

<Functional configuration of cloud server>
FIG. 35 is a block diagram showing a functional configuration of the cloud server 3420 according to the present embodiment. In FIG. 35, only the functional components related to the accumulation of detected attacks and infection information and the provision of the learning information are shown, and the functional components related to other communication agents are to avoid complexity. Not shown. In FIG. 35, the same functional components as those in FIG. 5 of the second embodiment are denoted by the same reference numerals, and the description thereof is omitted.

  The infection information storage unit 3501 stores the infection information detected by the infection prevention unit 502 in the attack target learning DB 3424 together with the terminal transmission data. The attack information storage unit 3502 stores the attack information detected by the attack exclusion unit 509 in the attack target learning DB 3424 together with the terminal reception data.

  The attack target analysis unit 3503 having the attack target analysis table 3503a analyzes the attack target based on the attack and infection history information accumulated in the attack target learning DB 3424. The attack warning information generation unit 3504 generates attack warning information for reporting to the client device and the service providing server from the analysis result of the attack target analysis unit 3503. The terminal transmission data transmission unit 3508 of FIG. 35 has a function of transmitting attack warning information to the service providing server in addition to the function of the terminal transmission data transmission unit 508 of FIG. The terminal reception data transmission unit 3513 of FIG. 35 has a function of transmitting attack warning information to the client device in addition to the function of the terminal reception data transmission unit 513 of FIG.

(Attack target learning DB)
FIG. 36 is a diagram showing a configuration of the attack target learning DB 3424 according to the present embodiment. The configuration in FIG. 36 is an example, and the present invention is not limited to this.

  The attack target learning DB 3424 includes service target information 3610 for storing attacks and infections associated with provided services, service type information 3620 for storing attacks and infections associated with service types, and service provision paths. Service path information 3630 for storing associated attacks and infections.

  The service target information 3610 stores a plurality of service providing servers 3612 that have detected an attack or infection in association with the service providing owner 3611 that has detected an attack or infection. A plurality of service contents 3613 in which attacks or infections are detected are stored in association with each service providing server 3612. Then, the attack content 3614 and the attack count 3615 are stored in association with each service content 3613.

  The service type information 3620 stores a plurality of keywords 3622 that have detected an attack or infection in association with the keyword group 3621 in the service data in which an attack or infection has been detected. Then, the attack content 3623 and the number of attacks 3624 are stored in association with each keyword 3622.

  The service route information 3630 stores a plurality of routers 3632 included in the access route in association with the service-provided access route 3631 in which an attack or infection is detected. Then, the attack contents 3633 and the number of attacks 3634 are stored in association with each router 3632.

(Attack target analysis table)
FIG. 37 is a diagram showing a configuration of the attack target analysis table 3503a according to the present embodiment. Note that the configuration of the attack target analysis table 3503a is not limited to FIG.

  The attack target analysis table 3503a stores a plurality of attack contents 3702 in association with each attack target 3701. In association with each attack content 3702, the number of attacks 3703, an attack range 3704 indicating an area where attacks and infections spread, and an attack frequency 3705 for a predetermined unit period are stored.

  And the warning condition 3706 for determining whether the warning to a client apparatus or a service provision server is required, and the warning necessity flag 3707 which is a determination result based on the warning condition are memorize | stored. The warning condition 3706 may be different depending on the contents of each attack or infection, or depending on the client device and the service providing server.

《Cloud server processing procedure》
FIG. 38 is a flowchart showing a processing procedure of attack target learning processing by the cloud server 3420 according to the present embodiment. Note that the flowchart of FIG. 38 shows only the attack target learning process, and the communication procedure performed by the other cloud server 3420 executes the processing procedure described above with reference to FIG. 11 or FIG.

  First, in step S3811, it is determined whether an attack or infection has been detected in the infection prevention unit or the attack exclusion unit. In step S3821, it is determined whether it is the timing of the attack target analysis by the cloud server 3420.

  If there is an attack or infection, the process proceeds to step S3813 to acquire attack target information. Next, in step S3815, the contents of the attack or infection are acquired. In step S3817, attack target information and attack details are stored in the attack target learning DB 3424. At the same time, the learning information of the attack target may be notified to the client device or the service providing server.

  If it is time to analyze the attack target, the process advances to step S3823 to search the attack target learning DB 3424 and collect information on the attack and infection. Next, in step S3825, an attack target analysis table 3503a as shown in FIG. 37 is created. Then, the attack target is predicted (the warning necessity flag 3707 is necessary), and the warning information is notified to the client device and the service providing server.

[Ninth Embodiment]
Next, an information processing system according to the ninth embodiment of the present invention will be described. Compared to the second to eighth embodiments, the information processing system according to the present embodiment performs an attack and infection on a cloud server for a certain period of time before the program is downloaded to the client device (proxy verification). However, it is different in that download to the client device is permitted if there is no problem. Since other configurations and operations are the same as those of the second to seventh embodiments, the same configurations and operations are denoted by the same reference numerals, and detailed description thereof is omitted.

  According to the present embodiment, in the information processing system, the cloud server sufficiently checks before downloading to the client device, so that it is possible to suppress the occurrence of attacks and infections in advance.

<< Operation procedure of information processing system >>
FIG. 39 is a sequence diagram showing an operation procedure of communication proxy in the information processing system 3900 according to this embodiment. FIG. 39 shows only an operation procedure related to the present embodiment. Other operations are the same as those in the second to eighth embodiments.

  First, in step S3901, in the client apparatuses 211 to 216, an installation request is input from the client to the program. The program request is notified from the client device to the cloud server 3920 in step S3903. The proxy verification of the cloud server 3920 may be started not by a request from a client device but by a request from a service providing server.

  In step S3905, the cloud server 3920 acquires the target program from the service providing server. Next, in step S3907, the acquired program is stored in the installation program DB 3925. In step S3909, the program substitution execution process is started.

  During the program proxy verification process, an attack / infection check is performed in step S3911. The result is accumulated in the attack / infection information DB 223. The history of check results is also accumulated in the attack target learning DB 3424 in step S3913. Then, in step S3915, the cloud server 3920 determines whether to download the target program. Such determination may be performed at any time, periodically, or at the request of the client device or the service providing server. If not approved, the program will continue to be verified.

  If it is download permission, in step S3917, a notification of download permission to the client is transmitted to the client device. In the client device, the target program is downloaded in step S3919. In step S3921, the downloaded program is executed.

<Functional configuration of cloud server>
FIG. 40 is a block diagram showing a functional configuration of the cloud server 3920 according to the present embodiment. In FIG. 40, the same functional components as those in FIG. 5 of the second embodiment and FIG. 35 of the eighth embodiment are denoted by the same reference numerals, and description thereof is omitted.

  The installation program DB 3925 stores and manages programs requested by clients to download to their client devices and programs newly provided from the service providing servers 230 to 250. The program includes a plug-in to the WEB application.

  The virtual PC 4003 is a virtual PC corresponding to the client apparatus that has requested download of the program. The virtual PC 4003 has a download permission table 4003a and manages whether each program can be downloaded. This management may be commonly performed in the installation program DB 3925. The virtual PC 4003 reads out and executes the program from the installation program DB 3925, checks an attack or infection in the execution process, and stores the history in the attack target learning DB 3424. At the same time, the result is recorded in the installation program DB 3925 in association with each program. Based on these check histories, it is stored whether each program in the download permission table 4003a is permitted.

  The program download unit 4004 reads the program whose permission is indicated in the download permission table 4003a from the installation program DB 3925 and downloads it to the client device.

[Other Embodiments]
Although the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. In addition, a system or an apparatus in which different features included in each embodiment are combined in any way is also included in the scope of the present invention. For example, by combining the configuration of the second embodiment and the configuration of the fifth embodiment, the Web service may be performed by the conversion of the fifth embodiment, and other mails may be performed by the conversion of the second embodiment. That is, the client device may be able to select whether all communication is delegated to the cloud server or only the Web service is delegated to the cloud server.

  In addition, the present invention may be applied to a system composed of a plurality of devices, or may be applied to a single device. Furthermore, the present invention can also be applied to a case where a control program that realizes the functions of the embodiments is supplied directly or remotely to a system or apparatus. Therefore, in order to realize the functions of the present invention with a computer, a control program installed in the computer, a medium storing the control program, and a WWW (World Wide Web) server for downloading the control program are also included in the scope of the present invention. include.

Claims (17)

The first information processing apparatus is connected to the first information processing apparatus via a network and has substantially the same or higher defense capability against an attack than the first information processing apparatus. An information processing system including a second information processing apparatus,
Communication proxy means of the second information processing device acting as a proxy for at least part of the communication connection between the first information processing device and an external network or external device;
Attack blocking means for blocking an attack included in communication connection by the communication proxy means between the first information processing apparatus and the external network or the external apparatus;
Equipped with a,
The communication proxy means is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking unit detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy unit is deleted, a new virtual computer is generated, and the communication is performed. information processing system communicating substitution control means for substituting the communication connection of the first information processing apparatus, characterized by comprising Rukoto by proxy means. The attack blocking means further includes attack elimination means for detecting and eliminating an attack included in communication data output from the external network or the external device,
2. The information processing according to claim 1, wherein the communication proxy means includes first communication data transfer means for transferring communication data from which an attack has been eliminated by the attack elimination means to the first information processing apparatus. system. The attack blocking means further includes infection prevention means for preventing infection based on communication data output from the first information processing apparatus,
3. The communication agent means according to claim 1, further comprising: a second communication data transfer means for transferring the communication data that has been prevented from being infected by the infection prevention means to the external network or the external device. Information processing system.   4. The information processing system according to claim 1, wherein the communication proxy means includes communication data cache means for temporarily storing communication data. Said communication proxy means has a virtual Web browser controls in place of the communication with the Web server to the first information processing apparatus, and transfers the decompressed data prior Symbol virtual Web browser is deployed to the first information processing apparatus The information processing system according to claim 1, wherein: The attack blocking means determines that there is an attack and blocks the attack when the data amount of the expanded data developed by the virtual Web browser exceeds a predicted data amount. Information processing system. A plurality of the first information processing devices are communicatively connected to the second information processing device;
The information processing system according to claim 5 or 6, wherein the communication proxy means transfers the expanded data expanded by the Web browser to the plurality of first information processing apparatuses. The attack blocking means detects an attack related to a new application installed in the virtual computer over a predetermined period,
Permission means for permitting installation of the application on the first information processing apparatus when the attack blocking means does not detect an attack over the predetermined period;
The information processing system according to claim 1 , further comprising: The information processing system is a thin client server system,
The information processing system according to any one of claims 1 to 8 , wherein the first information processing apparatus is a client apparatus, and the second information processing apparatus is a server. The second information processing apparatus
Attack target learning means for storing the attack detected by the attack blocking means in association with the attack target targeted by the attack;
Attack warning means for notifying the first information processing apparatus or the external apparatus of information related to the attack target accumulated in the attack target learning means;
The information processing system according to claim 9 , further comprising: A first information processing apparatus are communicatively connected via a network with respect to the first information processing apparatus to have a substantially equal or higher protective capacity against challenge compared to the first information processing apparatus an information processing method in an information processing system and a second information processing apparatus,
A communication proxy step of the second information processing device that performs at least a part of communication connection between the first information processing device and an external network or an external device;
An attack blocking step for blocking an attack included in a communication connection in the communication proxy step between the first information processing device and the external network or the external device;
Only including,
The communication agent step is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking step detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy step is deleted, a new virtual computer is generated, and the communication is performed. the communication proxy control step of substituting the communication connection of the first information processing apparatus by proxy step, an information processing method comprising including Mukoto. Communicatively coupled via the first information processing device and the network, a second information processing apparatus having a substantially equal or higher protective capacity against challenge compared to the first information processing apparatus,
Communication proxy means for proxying at least a part of communication connection with the external network or the external device by the first information processing device;
Attack blocking means for blocking an attack included in communication connection by the communication proxy means between the first information processing apparatus and the external network or the external apparatus;
Equipped with a,
The communication proxy means is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking unit detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy unit is deleted, a new virtual computer is generated, and the communication is performed. communication substitution control means for substituting the communication connection of the first information processing apparatus by substituting means, the second information processing apparatus, characterized in comprising Rukoto. Communicatively coupled via the first information processing device and the network, a control method of the second information processing apparatus having a substantially equal or higher protective capacity against challenge compared to the first information processing apparatus ,
A communication proxy step of acting as a proxy for at least part of the communication connection with the external network or the external device by the first information processing device;
An attack blocking step for blocking an attack included in a communication connection in the communication proxy step between the first information processing device and the external network or the external device;
Only including,
The communication agent step is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking step detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy step is deleted, a new virtual computer is generated, and the communication is performed. the communication proxy control step of substituting the communication connection of the first information processing apparatus by proxy step, the control method of the second information processing apparatus, characterized in including Mukoto. A control program for a second information processing apparatus that is communicably connected to the first information processing apparatus via a network and has substantially the same or higher defense capability against attack than the first information processing apparatus,
A communication proxy step of performing at least a part of communication connection with the external network or the external device by the first information processing device;
An attack blocking step for blocking an attack included in a communication connection in the communication proxy step between the first information processing device and the external network or the external device;
To the computer ,
The communication agent step is included in a virtual computer generated by the second information processing apparatus and associated with the first information processing apparatus,
When the attack blocking step detects an attack included in the communication connection with the external network or the external device, the virtual computer including the communication proxy step is deleted, a new virtual computer is generated, and the communication is performed. A control program for a second information processing apparatus , comprising: a communication proxy control step for proxying communication connection of the first information processing apparatus by a proxy step . Communicatively connected via a second information processing apparatus and the network of claim 12, the first information processing apparatus having a substantially equal or lower protective capacity against challenge compared to the second information processing apparatus Because
A communication proxy request means for requesting to intercept at least a portion of the communication connection with the external network or an external device by the communication proxy unit the second information processing apparatus is the first information processing apparatus,
Communication data attacked by the attack blocking means is blocked by the second information processing apparatus, receiving means for receiving,
A first information processing apparatus comprising: Communicatively connected via a second information processing apparatus and the network of claim 12, the first information processing apparatus having a substantially equal or lower protective capacity against challenge compared to the second information processing apparatus Control method,
A communication proxy request step for requesting to intercept at least a portion of the communication connection with the external network or an external device by the communication proxy unit the second information processing apparatus is the first information processing apparatus,
Communication data attacked by the attack blocking means is blocked with said second information processing apparatus, a receiving step of receiving,
The control method of the 1st information processing apparatus characterized by including. Communicatively connected via a second information processing device and the network of claim 12, the first information processing apparatus having a substantially equal or lower protective capacity against challenge compared to the second information processing apparatus Control program
A communication proxy request step for requesting to intercept at least a portion of the communication connection with the external network or an external device by the communication proxy unit the second information processing apparatus is the first information processing apparatus,
Communication data attacked by the attack blocking means is blocked with said second information processing apparatus, a receiving step of receiving,
A program for controlling the first information processing apparatus, which causes a computer to execute.

Images